CVE-2026-100745

Executive Summary

CVE-2026-100745 is a stack-based buffer overflow in the Edimax BR-6428nC wireless router running firmware version 1.16. The flaw resides in the Wireless Wizard Handler and is triggered through the /goform/formWizSurvey endpoint by manipulating the interface1/interface2 arguments. A remote attacker can exploit the vulnerability, and exploit code has been disclosed to the public, raising the likelihood of opportunistic attacks against internet-exposed devices. With no vendor patch available and no CISA KEV listing, affected organizations must rely on network isolation and compensating controls.

Technical Analysis

The vulnerability is classified as CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and manifests as a stack-based buffer overflow. According to the NVD description, the impacted element is an unknown function within the file /goform/formWizSurvey, which belongs to the "Wireless Wizard Handler" component of the Edimax BR-6428nC firmware version 1.16.

The attack vector is network-accessible. Manipulation of the interface1 and/or interface2 arguments supplied to the /goform/formWizSurvey handler causes data to be written beyond the bounds of a fixed-size stack buffer. In a stack-based overflow of this class, uncontrolled input is copied into a stack-allocated buffer without adequate length validation. When the input exceeds the buffer capacity, adjacent stack memory — potentially including saved registers and the return address — is overwritten. This can result in process crash (denial of service) or, under the right conditions, controlled execution flow redirection (remote code execution).

The CVSS v3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L indicates the following characteristics:

• AV:N (Network) — the vulnerability is exploitable over the network, consistent with the web-based management interface of the router.
• AC:L (Low) — no specialized conditions or race windows are required; the attack is straightforward once the endpoint is reachable.
• PR:L (Low) — the attacker requires some level of privilege or authentication to reach the handler. This suggests the /goform/formWizSurvey endpoint may require an authenticated session (e.g., administrative login) or a low-privilege token before the vulnerable argument processing occurs.
• UI:N (None) — no user interaction is required.
• S:U (Unchanged) — the exploit does not cross a security authority boundary; impact is confined to the vulnerable component.
• C:L/I:L/A:L — low confidentiality, integrity, and availability impact, consistent with a memory-corruption flaw where reliable RCE may not be guaranteed but crash and partial control are achievable.

Because the NVD description does not disclose the specific function name, buffer size, or exact copy operation, further code-level detail cannot be asserted without the firmware binary. The public disclosure of exploit code increases the practical risk that a working proof-of-concept exists, even though no PoC or Nuclei template is tracked in the provided dataset.

The affected product is a consumer/SOHO wireless router. Such devices are frequently exposed on the public internet via their WAN management interfaces or misconfigured port forwarding, making remote exploitation plausible at scale.

Exploitation Scenarios

No public PoC is available in the provided dataset; the attack chain below is inferred from the vulnerability class (stack-based buffer overflow via HTTP argument manipulation) and the NVD description.

1. Reconnaissance / Target Identification An attacker scans for internet-exposed Edimax BR-6428nC devices. This can be done using Shodan or similar engines with dorks such as product:"Edimax BR-6428nC", http.title:"Edimax", or http.html:"goform". The attacker confirms the device is running firmware version 1.16 and that the management interface is reachable.

2. Triggering the Flaw The attacker sends an HTTP request to the /goform/formWizSurvey endpoint. The request includes the interface1 and/or interface2 arguments, populated with an oversized value. The handler does not adequately validate the length of these arguments before copying them into a stack buffer. If the endpoint requires authentication (consistent with PR:L), the attacker first obtains low-privilege credentials (e.g., default or weak admin credentials) or reuses a valid session.

3. Payload / Execution Method The oversized input overwrites stack memory. Depending on the exact firmware build, this can corrupt the saved return address or other control data. A crafted payload may lead to a crash (DoS) or, if the attacker can place shellcode and redirect execution, to arbitrary code execution. Because the exact buffer size and memory layout are not disclosed in the NVD description, the precise payload construction cannot be detailed here; it would require reverse engineering of the firmware or use of the publicly disclosed exploit code.

4. Post-Exploitation Impact Successful exploitation could allow the attacker to crash the device (availability impact) or execute code with the privileges of the web server process — typically root on embedded routers. This enables persistent backdooring, traffic interception, botnet enrollment (e.g., Mirai-style), or lateral movement into the internal network. The CVSS confidentiality, integrity, and availability impacts are all rated Low, suggesting that full compromise may not be guaranteed, but partial impact is expected.

Given that exploit code has been disclosed to the public, the barrier to entry for less sophisticated actors is reduced. Mass scanning and exploitation attempts should be anticipated, particularly against devices with default credentials.

Impact Assessment

The CVSS v3.1 base score is 6.3 (Medium). The vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L reflects a remotely exploitable memory-corruption issue that requires low privileges and no user interaction, with limited but non-zero impact across confidentiality, integrity, and availability.

Affected Systems: Edimax BR-6428nC wireless routers running firmware version 1.16. No other versions are listed as affected in the provided data.

Blast Radius: These are SOHO/consumer devices. In enterprise environments, they may appear as branch-office gateways, lab equipment, or unauthorized shadow IT. An exploited router can serve as a pivot point into the local network, intercept or manipulate traffic, and participate in DDoS botnets. Because the device is often placed at the network edge, a compromise can expose all downstream hosts.

Business Impact:

• Availability: A crash of the router disrupts connectivity for all users behind it (A:L).
• Integrity: An attacker with code execution could alter routing, DNS, or firewall rules (I:L).
• Confidentiality: Traffic passing through the device could be inspected or redirected (C:L).
• Reputation/Compliance: Unpatched edge devices are a common audit finding; exploitation could lead to data breach or regulatory scrutiny.

The public availability of exploit code elevates the urgency, even with a Medium base score.

Detection Guidance

Sigma Rule

title: Edimax BR-6428nC formWizSurvey Stack Buffer Overflow Attempt
id: 8f4a2c1e-5b7d-4e9a-9c3f-1a2b3c4d5e6f
status: experimental
description: Detects HTTP requests to /goform/formWizSurvey with excessively long interface1 or interface2 parameters, indicative of CVE-2026-100745.
author: Threat Intelligence Team
date: 2026-01-01
logsource:
  category: webserver
  product: edimax
detection:
  selection_endpoint:
    cs-uri-stem|contains: '/goform/formWizSurvey'
  selection_params:
    cs-uri-query|contains:
      - 'interface1='
      - 'interface2='
  selection_length:
    cs-uri-query|re: 'interface[12]=.{256,}'
  condition: selection_endpoint and selection_params and selection_length
fields:
  - c-ip
  - cs-uri-stem
  - cs-uri-query
  - cs-user-agent
falsepositives:
  - Legitimate administrative configuration with unusually long interface names (unlikely)
level: high
tags:
  - attack.t1190
  - cve.2026.100745

YARA Rule

rule CVE_2026_100745_Edimax_formWizSurvey_Overflow
{
    meta:
        description = "Detects HTTP requests attempting to exploit CVE-2026-100745 in Edimax BR-6428nC firmware 1.16 via /goform/formWizSurvey"
        author = "Threat Intelligence Team"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-100745"
        cve = "CVE-2026-100745"

    strings:
        $endpoint = "/goform/formWizSurvey"
        $param1 = "interface1="
        $param2 = "interface2="

    condition:
        $endpoint and any of ($param*) and filesize < 10KB
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-100745 Edimax BR-6428nC formWizSurvey Stack Buffer Overflow Attempt"; flow:to_server,established; http.uri; content:"/goform/formWizSurvey"; http.uri; content:"interface1="; http.uri; content:"interface2="; pcre:"/interface[12]=.{256,}/U"; classtype:attempted-admin; reference:cve,2026-100745; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-100745; sid:2026100745; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5s
  [network where network.protocol == "http" and url.path == "/goform/formWizSurvey" and url.query : "interface1=*"]
  [network where network.protocol == "http" and url.path == "/goform/formWizSurvey" and url.query : "interface2=*"]

Splunk SPL Query

index=web sourcetype=access_combined
| where like(uri, "%/goform/formWizSurvey%") AND (like(uri, "%interface1=%") OR like(uri, "%interface2=%"))
| rex field=uri "interface[12]=(?<iface_value>[^&]+)"
| where len(iface_value) > 255
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, uri, user_agent
| convert ctime(first_seen) ctime(last_seen)

Wazuh OSSEC Rule

<group name="web,edimax,cve-2026-100745">
  <rule id="100745" level="12">
    <decoded_as>web-accesslog</decoded_as>
    <url>/goform/formWizSurvey</url>
    <regex>interface[12]=.{256,}</regex>
    <description>CVE-2026-100745: Edimax BR-6428nC formWizSurvey stack buffer overflow attempt detected</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_100745,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No vendor patch, firmware update, or official fix is available from any tracked source. No workarounds are listed. Organizations must treat the device as end-of-life from a security perspective until a fix is released.

1. Immediate Mitigations

• Isolate the device: Place the Edimax BR-6428nC on a dedicated VLAN with strict firewall rules. Do not expose the management interface (/goform/) to the internet. Block inbound access to the router's web UI from WAN.
• Restrict access: If remote management is required, allow only trusted IPs via firewall ACLs. Disable WAN-side management entirely if possible.
• Change default credentials: Even though PR:L suggests authentication may be required, default or weak passwords are a common entry point. Enforce strong, unique admin passwords.
• Monitor for exploitation: Deploy the detection rules above to alert on oversized interface1/interface2 parameters targeting /goform/formWizSurvey.
• Network segmentation: Ensure the router cannot reach critical internal assets; treat it as untrusted.

2. Patch / Upgrade Steps

• No patch is available. Monitor the Edimax support site and NVD entry for CVE-2026-100745 for firmware updates.
• If the device is no longer supported, plan for replacement with a vendor that provides security updates.
• If a patch is later released, test and apply it immediately; verify the firmware version post-upgrade.

3. Long-Term Hardening

• Maintain an inventory of edge devices and their firmware versions; track end-of-support dates.
• Adopt a policy of replacing SOHO routers that no longer receive security patches.
• Implement network access control (NAC) to prevent unauthorized devices from connecting.
• Conduct regular vulnerability scans of internet-facing assets and remediate based on risk.
• Use the detection rules as part of continuous monitoring; review logs for anomalies in /goform/formWizSurvey requests.

References

1. NVD — CVE-2026-100745: https://nvd.nist.gov/vuln/detail/CVE-2026-100745
2. MITRE CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer — https://cwe.mitre.org/data/definitions/119.html
3. MITRE ATT&CK T1190: Exploit Public-Facing Application — https://attack.mitre.org/techniques/T1190/
4. Edimax BR-6428nC product page / support (for firmware updates): https://www.edimax.com/
5. CISA Known Exploited Vulnerabilities Catalog (not listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No specific threat actor campaigns or exploit-in-the-wild evidence are available in the provided dataset. The public disclosure of exploit code increases the risk of opportunistic exploitation; organizations should monitor for scanning activity targeting /goform/formWizSurvey.